CRITICAL🇵🇱 Wersja polska

CVE-2025-46199

CVSS 9.8v3.1pub. 2025-07-25upd. 2025-08-15

Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute arbitrary code via a crafted script to the form fields

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Getgrav Grav

    APP
    Getgrav
    ≤ 1.7.48
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCEXSS
CWE
References

Related vulnerabilities

CVE-2021-47812CRITICAL9.3PL ✓ten sam produkt

GravCMS – nieuwierzytelniony zapis YAML i zdalne wykonanie kodu PHP

CVE-2025-66844CRITICAL9.1PL ✓ten sam produkt

SSRF w Getgrav Grav przez szablony Twig — dostęp do zasobów wewnętrznych

CVE-2023-34251CRITICAL9.9ten sam produkt

Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template...

CVE-2026-42844HIGH8.7ten sam produkt

Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.medi...

CVE-2026-42608HIGH8.8ten sam produkt

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the F...